Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

This lab isolates Quoted HTML attribute breakout. Search text is reflected in the value attribute of an input. Angle brackets are encoded, but the delimiting double quote is not. The quote ends value and creates an onmouseover attribute on the existing input; no new tag is required.

Lab objective/setup

Open the Academy exercise at the reserved lab URL and work only in that disposable environment. The required proof is specific: Moving the pointer over the search field fires the handler and solves the lab.

What I observed

Search text is reflected in the value attribute of an input. Angle brackets are encoded, but the delimiting double quote is not. The quote ends value and creates an onmouseover attribute on the existing input; no new tag is required.

Academy objective says angle brackets are encoded and requires reflected XSS by injecting an attribute.
Academy objective says angle brackets are encoded and requires reflected XSS by injecting an attribute.
Search results display an encoded script probe as text and preserve it in the search input value, showing that new tags cannot be introduced directly.
Search results display an encoded script probe as text and preserve it in the search input value, showing that new tags cannot be introduced directly.

Why it is vulnerable

The application applies protection for the wrong parser or omits a control at the decisive boundary. In this case, search text is reflected in the value attribute of an input. Angle brackets are encoded, but the delimiting double quote is not. Browser parsing therefore preserves the attacker-controlled behavior instead of reducing the value to inert text or a safe URL.

Walkthrough in the authorized PortSwigger lab

First reproduce the recorded page or request and inspect the exact reflected, stored, or DOM-generated context described above. Then supply the following lab payload as data, not as active markup in this article:

1
`" onmouseover="alert(1)`

The quote ends value and creates an onmouseover attribute on the existing input; no new tag is required.

Results heading shows the inert quote-and-image probe, used to establish that a double quote can terminate the existing input value attribute.
Results heading shows the inert quote-and-image probe, used to establish that a double quote can terminate the existing input value attribute.
Solved page reflects the inert text `" onmouseover="alert(1)` in the heading while the existing search input carries the injected mouseover handler.
Solved page reflects the inert text `" onmouseover="alert(1)` in the heading while the existing search input carries the injected mouseover handler.

Verification

Moving the pointer over the search field fires the handler and solves the lab. This distinguishes execution from a payload merely appearing in source or being stored without reaching the required event or sink.

Impact and defensive lesson

In a real application, equivalent XSS could act with the victim’s same-origin privileges, expose readable data, or perform authenticated actions. Fix the data flow at its context: use text-only DOM APIs, JavaScript- or attribute-aware encoding, strict URL-scheme allowlists, and maintained sanitization where HTML is unavoidable. HttpOnly cookies and a restrictive CSP reduce consequences but do not repair the injection flaw.

References